AWS Production Deployment

This guide walks through a recommended AWS setup for deploying a WCH project using Amazon S3 and Amazon CloudFront.

Recommended architecture:

WCH → S3 Bucket (private) → CloudFront CDN → Website Visitors

This setup provides:

  • Private and secure S3 storage
  • CDN performance through CloudFront
  • SSL support through AWS Certificate Manager (ACM)
  • Better caching and scalability
  • Production-ready deployment workflows

‍

1. Create an S3 Bucket

Go to the S3 section in the AWS Console and click Create bucket.

Bucket configuration

Bucket name
Enter the domain name for your site. Example:

www.example.com

💡 The bucket name should match your website domain for easier setup later.

Block Public Access

Leave Block all public access enabled.

⚠️ Do not make the bucket public. CloudFront will securely access the bucket using Origin Access Control (OAC).

Click Create bucket to finish setup.

‍

2. IAM Setup

WCH can deploy using either:

  • IAM User
  • IAM Role (recommended)

Option A: IAM User

Go to IAM in AWS and click:

Access Management → Users

Click Create User.

Step 1: Name the User

Enter a name for the user.

Step 2: Create Policy

Select:

Attach Policy Directly

Click Create Policy and add the following:

{
 "Version": "2012-10-17",
 "Statement": [
   {
     "Sid": "AllowUsersToAccessS3Bucket",
     "Effect": "Allow",
     "Action": [
       "s3:GetObject*",
       "s3:PutObject*",
       "s3:DeleteObject*"
     ],
     "Resource": [
       "arn:aws:s3:::{YOUR BUCKET NAME}/*"
     ]
   },
   {
     "Effect": "Allow",
     "Action": [
       "s3:ListBucket*"
     ],
     "Resource": [
       "arn:aws:s3:::{YOUR BUCKET NAME}"
     ]
   }
 ]
}

Replace:

{YOUR BUCKET NAME}

with your actual bucket name.

Return to the user creation screen, refresh policies, and attach the new policy.

Click Create User.

Step 3: Create Access Keys

Open the newly created user.

Go to:

Security Credentials → Create Access Keys

⚠️ Make sure to save the Access Key and Secret Key. The secret will not be shown again.

These credentials are added to the WCH connector.

‍

Option B: IAM Role (Recommended)

IAM Roles avoid long-lived AWS credentials and support more secure deployments.

Go to:

IAM → Roles → Create Role

Step 1: Trusted Entity

Select:

AWS Account

Under:

This Account

copy your AWS Account ID.

Step 2: Permissions

Create and attach the same S3 policy used in Option A.

Step 3: Name the Role

Example:

S3-Deployment-Role

Step 4 (Optional): Add External ID

You may optionally add an External ID for additional security.

‍

Example trust policy:

{
 "Version": "2012-10-17",
 "Statement": [
   {
     "Effect": "Allow",
     "Principal": {
       "AWS": "arn:aws:iam::{YOUR ACCOUNT ID}:root"
     },
     "Action": "sts:AssumeRole",
     "Condition": {
       "StringEquals": {
         "sts:ExternalId": "{YOUR EXTERNAL ID}"
       }
     }
   }
 ]
}

Replace:

{YOUR ACCOUNT ID}

with your AWS account ID.

Replace:

{YOUR EXTERNAL ID}

with a secure random string.

⚠️ Save the External ID if configured. It will be required in WCH.

Once created, copy the Role ARN and add it to the WCH connector.

‍

3. Set Up CI/CD Pipeline

Go to AWS CodePipeline and click:

Create Pipeline

When prompted to choose the type, select:

Custom Pipeline

Pipeline Setup

Pipeline name
Enter a name for your pipeline.

Source Provider

Select:

S3

Choose the S3 bucket created earlier.

For the object key, enter:

project.zip

(or the name of your deployment ZIP file).

Build Stage

Skip this step.

Test Stage

Skip this step.

Deploy Provider

Choose:

S3

Select the same bucket.

Leave deployment path empty.

Enable:

Extract File Before Deploy

Click Create Pipeline.

‍

4. Create SSL Certificate (ACM)

Go to AWS Certificate Manager (ACM).

⚠️ CloudFront certificates must be created in:

us-east-1

Click:

Request Certificate

Add Domains

Example:

example.com
www.example.com

Validation Method

Choose:

DNS Validation

Add the provided DNS validation records to your DNS provider.

Wait for the certificate to be issued before continuing.

‍

5. Set Up CloudFront Distribution

Go to CloudFront and click:

Create Distribution

Origin Configuration:

Origin Domain

Select your S3 bucket.

⚠️ Do not use the S3 Website Endpoint.

Use the standard S3 bucket origin instead. Example:

bucket-name.s3.amazonaws.com

Origin Access

Under Origin Access, choose:

Origin Access Control (OAC)

Create a new OAC if prompted.

Allow CloudFront to automatically update the bucket policy.

This allows:

  • private S3 buckets
  • secure origin access
  • no public S3 access

Default Root Object

Set: index.html

Alternate Domain Name (CNAME)

Add your custom domain. Example:

www.example.com

SSL Certificate

Select the ACM certificate created earlier.

Cache Settings

Recommended caching approach:

  • Use standard CloudFront caching
  • Setting all TTL values to 0 is easier for testing and seeing updates to your site but a longer value is recommended for production.

💡 Disabling caching entirely removes many CDN performance benefits.

Error Pages

Configure custom error responses.

HTTP ErrorResponse Page
403/404.html
404/404.html

Finish Setup

Create the distribution. Once created, copy the CloudFront domain name. Example:

d123abc.cloudfront.net

Update your DNS settings to point your domain to the CloudFront distribution.

‍

6. Configure WCH Destinations

In WCH, configure:

  • a preproduction destination
  • a production destination

The production destination will deploy the exact same project.zip that was previously tested in preproduction.

‍
(Optional)

7. Add Optional Site Improvements

Performance Features

AWS CloudFront supports additional performance optimizations.

  • Enable compression
  • Enable HTTP/2
  • Enable HTTP/3

These features can improve:

  • page load speed
  • bandwidth usage
  • mobile performance

Security Headers

Security headers may optionally be configured at the CloudFront layer. Common examples:

  • HSTS
  • X-Frame-Options
  • X-Content-Type-Options
  • Referrer-Policy
  • Content-Security-Policy (CSP)

These improve browser-side security protections.

Logging & Monitoring

Recommended monitoring features include:

  • CloudFront access logs
  • S3 access logs
  • CloudWatch alarms
  • AWS WAF logging

These can help monitor:

  • traffic spikes
  • deployment issues
  • elevated error rates

‍

This setup provides a recommended baseline AWS implementation for WCH deployments. Final infrastructure, DNS, security, compliance, and operational configurations remain the responsibility of the client or their infrastructure team.

‍